27166f9eb32845df3dce5799ba0bf758a44406ecde3b0cd425846419c10fdb4d

Sharing

Copy URL Twitter E-mail

General

Target
27166f9eb32845df3dce5799ba0bf758a44406ecde3b0cd425846419c10fdb4d
Size 277KB
Sample260910-mczzyaar31
SHA256 27166f9eb32845df3dce5799ba0bf758a44406ecde3b0cd425846419c10fdb4d
MD5 20fc3098437380ec411394c765798c8c
SHA1 f3a511e46e63c6b878121bf3571a34f3bb1b038d
SHA512 d3d0f184f5630b0a121c30f8a9f790f436e4807db49578f9a7430fdad0d692666ad1e85c1d1f4a8b4dec18dc17a6710e8b96acaeb83c9f6dee035093cba8c373
SSDEEP 3072:ypTVUK59JXluJvAupdqTqYhV5Srni94GiMF0FT5ni7bCuACMYhLu2lRxgv5yoQyb:+luWTZVKnzg0/ni7bNhQcLud3
TLSH
T15A543A313BE5E431C4E31279655EA66843BAF1A10F70D1CBF3981BAE8D206D25D38F96
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
27166f9eb32845df3dce5799ba0bf758a44406ecde3b0cd425846419c10fdb4d

File Explorer

27166f9eb32845df3dce5799ba0bf758a44406ecde3b0cd425846419c10fdb4d

.dll 277KB

27166f9eb32845df3dce5799ba0bf758a44406ecde3b0cd425846419c10fdb4d

IMPHASH b1bccb82aef970f8b650a5692d7ff450
SHA256 27166f9eb32845df3dce5799ba0bf758a44406ecde3b0cd425846419c10fdb4d
MD5 20fc3098437380ec411394c765798c8c
SHA1 f3a511e46e63c6b878121bf3571a34f3bb1b038d
SHA512 d3d0f184f5630b0a121c30f8a9f790f436e4807db49578f9a7430fdad0d692666ad1e85c1d1f4a8b4dec18dc17a6710e8b96acaeb83c9f6dee035093cba8c373
SSDEEP 3072:ypTVUK59JXluJvAupdqTqYhV5Srni94GiMF0FT5ni7bCuACMYhLu2lRxgv5yoQyb:+luWTZVKnzg0/ni7bNhQcLud3
TLSH
T15A543A313BE5E431C4E31279655EA66843BAF1A10F70D1CBF3981BAE8D206D25D38F96
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

165769

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SetupUi.pdb

advapi32

OpenProcessToken LookupAccountSidW GetTokenInformation GetServiceDisplayNameW QueryServiceStatus OpenServiceW CloseServiceHandle OpenSCManagerW

kernel32

CreateFileW SetFilePointer ReadFile MultiByteToWideChar SetLastError GetSystemDirectoryW FreeLibrary LoadLibraryW EnterCriticalSection LeaveCriticalSection GetCurrentThreadId RaiseException DeleteCriticalSection WaitForSingleObject GetCurrentProcess FlushInstructionCache FindResourceW LoadResource LockResource Process32NextW Process32FirstW CreateToolhelp32Snapshot OpenProcess GetTempFileNameW DeleteFileW Sleep CreateThread GetCurrentProcessId MoveFileW GetTempPathW WriteFile FlushFileBuffers CopyFileW GetDiskFreeSpaceExW GetTickCount InitializeCriticalSection GetStringTypeExW GetExitCodeThread InterlockedExchange SetThreadLocale SizeofResource FindResourceExW GetCurrentDirectoryW SetCurrentDirectoryW FormatMessageW GetLastError CloseHandle GetThreadLocale VirtualAlloc GetModuleFileNameW InterlockedPushEntrySList InterlockedCompareExchange GetProcessHeap WriteConsoleW SetStdHandle GetConsoleMode GetConsoleCP IsProcessorFeaturePresent RtlUnwind GetStringTypeW LCMapStringW IsValidCodePage GetOEMCP GetACP GetCPInfo HeapReAlloc HeapSize IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess QueryPerformanceCounter HeapDestroy HeapCreate GetEnvironmentStringsW WideCharToMultiByte FreeEnvironmentStringsW GetModuleFileNameA GetStartupInfoW GetFileType InitializeCriticalSectionAndSpinCount GetStdHandle SetHandleCount ExitProcess InterlockedDecrement InterlockedIncrement TlsFree TlsSetValue InterlockedPopEntrySList TlsGetValue TlsAlloc HeapAlloc HeapFree GetSystemTimeAsFileTime GetCommandLineA GetCommandLineW ExpandEnvironmentStringsW VirtualFree OutputDebugStringW GetModuleHandleW GetProcAddress GetVersionExW LocalFree

gdi32

GetObjectW DeleteObject CreateFontIndirectW

user32

SetWindowLongW IsWindow GetPropW EndDialog TranslateMessage PeekMessageW UnregisterClassA CallWindowProcW GetMenuItemInfoW SetForegroundWindow GetForegroundWindow SetMenuItemBitmaps InsertMenuW EnableMenuItem DestroyWindow GetWindowLongW CreateWindowExW DialogBoxParamW DispatchMessageW MsgWaitForMultipleObjects RemovePropW SetPropW DestroyIcon EnumWindows GetKeyState EnumChildWindows SetCursor MapDialogRect SetWindowsHookExW CallNextHookEx UnhookWindowsHookEx RegisterClassExW LoadCursorW GetClassInfoExW DefWindowProcW GetDesktopWindow GetMonitorInfoW MonitorFromWindow GetWindowThreadProcessId MessageBoxW GetDlgItem GetParent GetWindow SetDlgItemTextW SendDlgItemMessageW IsDlgButtonChecked CheckDlgButton EnableWindow IsWindowEnabled KillTimer SetTimer IsWindowVisible ShowWindow MapWindowPoints SetWindowPlacement GetWindowPlacement GetClientRect GetWindowRect SetWindowPos GetSystemMenu DrawMenuBar GetWindowTextLengthW GetWindowTextW SetWindowTextW PostMessageW SendMessageW LoadImageW

comctl32

CreatePropertySheetPageW DestroyPropertySheetPage PropertySheetW InitCommonControlsEx

comdlg32

GetSaveFileNameW GetOpenFileNameW

oleaut32

SysAllocStringLen SysFreeString SysStringLen SysStringByteLen SysAllocStringByteLen SysAllocString VariantClear VariantInit

ole32

CoCreateInstance CoUninitialize CoInitialize CoInitializeEx CoInitializeSecurity

shell32

ShellExecuteW

shlwapi

PathIsRootW PathGetDriveNumberW PathStripPathW PathRemoveFileSpecW PathQuoteSpacesW PathStripToRootW PathCombineW PathAppendW AssocQueryStringW PathIsRelativeW PathFileExistsW

userenv

ExpandEnvironmentStringsForUserW

psapi

GetModuleBaseNameW EnumProcessModules

Sharing

General

Malware Config

Signatures

File Explorer

27166f9eb32845df3dce5799ba0bf758a44406ecde3b0cd425846419c10fdb4d

advapi32

kernel32

gdi32

user32

comctl32

comdlg32

oleaut32

ole32

shell32

shlwapi

userenv

psapi

generic